August 2014 - keycloak-user - Jboss List Archives

by Nils Preusker

Hi, first of all, congrats on the beta 1 release! Here's my question: I have a WAR with a REST API that I'm securing with Keycloak. Now I'd like to add multitenancy support. If I understand the concept in keycloak correctly, I would somehow have to have several realms in the keycloak.json and the web.xml of the war, right? However there is just one realm-name attribute in the web.xml and the structure of keycloak.json also looks like it is intended for one realm. Am I missing something? Cheers, Nils

11 years, 11 months

3
14
0 / 0

Re: [keycloak-user] Direct Access Grants & 'Client

by Schneider, John DODGE CONSULTING SERVICES, LLC

Not sure if I follow you Bill. Don't we already have scope (role) assignment capabilities for both OAuth Clients and Applications? Date: Tue, 12 Aug 2014 12:13:21 -0400 From: Bill Burke <bburke(a)redhat.com<mailto:bburke@redhat.com>> Subject: Re: [keycloak-user] Direct Access Grants & 'Client Credentials' OAuth2 grant type To: keycloak-user(a)lists.jboss.org<mailto:keycloak-user@lists.jboss.org> Message-ID: <53EA3D21.7060609(a)redhat.com<mailto:53EA3D21.7060609@redhat.com>> Content-Type: text/plain; charset=windows-1252; format=flowed Right now we require you to create a user and give permissions to that user. Not sure if we'll add client credentials grant as it would require having role mappings for clients and applications.

11 years, 11 months

2
1
0 / 0

Direct Access Grants & 'Client Credentials' OAuth2 grant type

by Schneider, John DODGE CONSULTING SERVICES, LLC

Hi everyone, I've been evaluating the "Direct Access Grants" functionality of Keycloak. Overall, I think I can make it work for my use cases, but I do have a couple of concerns. Chapter 12 of the documentation compares Keycloak's Direct Access Grants functionality to OAuth2's "Resource Owner Password Credentials Grant." However, if I understand the specification correctly, this grant type is only for using the resource owner's credentials. What if we can't authorize using the resource owner credentials, but need to authorize the client itself using the client id and secret alone? For this, we need support for the "Client Credentials Grant". Is this planned for Keycloak 1.0? By adding the required "grant_type" parameter to the "tokens/grants/access" service endpoint, it seems like both the "password" and "client_credentials" could be supported, with the "client_credentials" grant type simply not requiring the username and password form parameters in the POST. Thoughts on this? Thanks, John

11 years, 11 months

3
2
0 / 0

"Remember Me" feature on Social Login

by Rodrigo Sasaki

Hi, I know this doesn't exist now, but I was wondering if it is something that is planned to be implemented, or if there's a particular reason why it isn't. Thanks! -- Rodrigo Sasaki

11 years, 11 months

2
11
0 / 0

SSO Session Idle Timeout for Direct Grants

by Schneider, John DODGE CONSULTING SERVICES, LLC

Hi, I'm finding that access tokens and refresh tokens are being invalidated after the setting in the "SSO Session Idle Timeout" has elapsed for the direct-grant API. Considering the direct-grant API enables browser-less application-to-application security, I'm not convinced that this is the right approach for many use cases. For reliable authorization and access token validation, it basically requires setting the "SSO Session Idle Timeout" to the value of the Access Token timeout, which for many use cases will be measured in hours or even days. Is there a good reason that "SSO Session Idle Timeout" should even be considered for direct-grants? Thanks, John

11 years, 11 months

2
1
0 / 0

"Client Credentials" OAuth2 flow

by Schneider, John DODGE CONSULTING SERVICES, LLC

Hi Bill, Any chance you can squeeze in support for the "Client Credentials" OAuth2 flow before the 1.0 release? In your last message on this subject you mentioned something about not having role assignments at the client level, but I didn't understand as it seems this is already supported. Can you please explain further? If this can't be done by the 1.0 release, then I suggest at least making the "grant_type" parameter be required in the "grants/access" endpoint, to be compliant with the OAuth spec and to set the foundation for future "Client Credentials" flow support. Thanks, John

11 years, 11 months

2
1
0 / 0

Re: [keycloak-user] Exported realm cannot be imported

by Christina Lau

I tried again from command line and got exactly the same error. ./standalone.sh -Dkeycloak.migration.action=import -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=dsgapi.json -Dkeycloak.migration.strategy=OVERWRITE_EXISTING 20:40:09,393 INFO [org.keycloak.exportimport.util.ImportUtils] (MSC service thread 1-15) Realm 'DSG_API' already exists. Removing it before import 20:40:09,558 WARN [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (MSC service thread 1-15) SQL Error: 23505, SQLState: 23505 20:40:09,559 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (MSC service thread 1-15) Unique index or primary key violation: "UK_ORVSDMLA56612EAEFIQ6WL5OI_INDEX_4 ON PUBLIC.REALM(NAME) VALUES ( /* 73 */ 'DSG_API' )"; SQL statement: insert into REALM (ACCESS_CODE_LIFESPAN, USER_ACTION_LIFESPAN, ACCESS_TOKEN_LIFESPAN, ACCOUNT_THEME, ADMIN_THEME, AUDIT_ENABLED, AUDIT_EXPIRATION, BRUTE_FORCE_PROTECTED, EMAIL_THEME, ENABLED, FAILURE_FACTOR, LOGIN_THEME, MASTER_ADMIN_APP, MAX_DELTA_TIME, MAX_FAILURE_WAIT, MINIMUM_QUICK_LOGIN_WAIT, NAME, NOT_BEFORE, PASSWORD_CRED_GRANT_ALLOWED, PASSWORD_POLICY, PRIVATE_KEY, PUBLIC_KEY, QUICK_LOGIN_CHECK, REGISTRATION_ALLOWED, REMEMBER_ME, RESET_PASSWORD_ALLOWED, SOCIAL, SSL_REQUIRED, SSO_IDLE_TIMEOUT, SSO_MAX_LIFESPAN, UPDATE_PROFILE_ON_SOC_LOGIN, VERIFY_EMAIL, WAIT_INCREMENT_SECONDS, ID) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) [23505-173] 20:40:09,560 INFO [org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl] (MSC service thread 1-15) HHH000010: On release of batch it still contained JDBC statements 20:40:09,569 ERROR [org.keycloak.exportimport.ExportImportManager] (MSC service thread 1-15) Error during export/import: org.keycloak.models.ModelDuplicateException: javax.persistence.PersistenceException: org.hibernate.exception.ConstraintViolationException: could not execute statement at org.keycloak.connections.jpa.PersistenceExceptionConverter.convert(PersistenceExceptionConverter.java:40) [keycloak-connections-jpa-1.0-beta-4.jar:] at org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:34) [keycloak-connections-jpa-1.0-beta-4.jar:] at com.sun.proxy.$Proxy88.flush(Unknown Source) at org.keycloak.models.jpa.JpaRealmProvider.createRealm(JpaRealmProvider.java:45) [keycloak-model-jpa-1.0-beta-4.jar:] at org.keycloak.models.cache.DefaultCacheRealmProvider.createRealm(DefaultCacheRealmProvider.java:161) [keycloak-invalidation-cache-model-1.0-beta-4.jar:] at org.keycloak.exportimport.util.ImportUtils.importRealm(ImportUtils.java:64) [keycloak-export-import-api-1.0-beta-4.jar:] at org.keycloak.exportimport.util.ImportUtils.importFromStream(ImportUtils.java:165) [keycloak-export-import-api-1.0-beta-4.jar:] at org.keycloak.exportimport.singlefile.SingleFileImportProvider$1.run(SingleFileImportProvider.java:43) [keycloak-export-import-single-file-1.0-beta-4.jar:] at org.keycloak.exportimport.util.ExportImportUtils.runJobInTransaction(ExportImportUtils.java:27) [keycloak-export-import-api-1.0-beta-4.jar:] at org.keycloak.exportimport.singlefile.SingleFileImportProvider.importModel(SingleFileImportProvider.java:38) [keycloak-export-import-single-file-1.0-beta-4.jar:] at org.keycloak.exportimport.ExportImportManager.checkExportImport(ExportImportManager.java:49) [keycloak-export-import-api-1.0-beta-4.jar:] at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:82) [keycloak-services-1.0-beta-4.jar:] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) [rt.jar:1.7.0_55] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) [rt.jar:1.7.0_55] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) [rt.jar:1.7.0_55] at java.lang.reflect.Constructor.newInstance(Constructor.java:526) [rt.jar:1.7.0_55] at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:148) [resteasy-jaxrs-3.0.8.Final.jar:] at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2175) [resteasy-jaxrs-3.0.8.Final.jar:] at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:295) [resteasy-jaxrs-3.0.8.Final.jar:] at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:236) [resteasy-jaxrs-3.0.8.Final.jar:] at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:112) [resteasy-jaxrs-3.0.8.Final.jar:] at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) [resteasy-jaxrs-3.0.8.Final.jar:] at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:214) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final] at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:119) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final] at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:505) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final] at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:88) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.start(UndertowDeploymentService.java:72) at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948) at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_55] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_55] at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_55] Caused by: javax.persistence.PersistenceException: org.hibernate.exception.ConstraintViolationException: could not execute statement at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1763) [hibernate-entitymanager-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1677) [hibernate-entitymanager-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1683) [hibernate-entitymanager-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.jpa.spi.AbstractEntityManagerImpl.flush(AbstractEntityManagerImpl.java:1338) [hibernate-entitymanager-4.3.5.Final.jar:4.3.5.Final] at sun.reflect.GeneratedMethodAccessor13.invoke(Unknown Source) [:1.7.0_55] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_55] at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_55] at org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:32) [keycloak-connections-jpa-1.0-beta-4.jar:] ... 30 more Caused by: org.hibernate.exception.ConstraintViolationException: could not execute statement at org.hibernate.exception.internal.SQLStateConversionDelegate.convert(SQLStateConversionDelegate.java:129) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:49) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:126) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:112) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(ResultSetReturnImpl.java:190) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.jdbc.batch.internal.NonBatchingBatch.addToBatch(NonBatchingBatch.java:62) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:3124) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:3581) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.action.internal.EntityInsertAction.execute(EntityInsertAction.java:104) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.spi.ActionQueue.executeActions(ActionQueue.java:463) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.engine.spi.ActionQueue.executeActions(ActionQueue.java:349) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.event.internal.AbstractFlushingEventListener.performExecutions(AbstractFlushingEventListener.java:350) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.event.internal.DefaultFlushEventListener.onFlush(DefaultFlushEventListener.java:56) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.internal.SessionImpl.flush(SessionImpl.java:1222) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] at org.hibernate.jpa.spi.AbstractEntityManagerImpl.flush(AbstractEntityManagerImpl.java:1335) [hibernate-entitymanager-4.3.5.Final.jar:4.3.5.Final] ... 34 more Caused by: org.h2.jdbc.JdbcSQLException: Unique index or primary key violation: "UK_ORVSDMLA56612EAEFIQ6WL5OI_INDEX_4 ON PUBLIC.REALM(NAME) VALUES ( /* 73 */ 'DSG_API' )"; SQL statement: insert into REALM (ACCESS_CODE_LIFESPAN, USER_ACTION_LIFESPAN, ACCESS_TOKEN_LIFESPAN, ACCOUNT_THEME, ADMIN_THEME, AUDIT_ENABLED, AUDIT_EXPIRATION, BRUTE_FORCE_PROTECTED, EMAIL_THEME, ENABLED, FAILURE_FACTOR, LOGIN_THEME, MASTER_ADMIN_APP, MAX_DELTA_TIME, MAX_FAILURE_WAIT, MINIMUM_QUICK_LOGIN_WAIT, NAME, NOT_BEFORE, PASSWORD_CRED_GRANT_ALLOWED, PASSWORD_POLICY, PRIVATE_KEY, PUBLIC_KEY, QUICK_LOGIN_CHECK, REGISTRATION_ALLOWED, REMEMBER_ME, RESET_PASSWORD_ALLOWED, SOCIAL, SSL_REQUIRED, SSO_IDLE_TIMEOUT, SSO_MAX_LIFESPAN, UPDATE_PROFILE_ON_SOC_LOGIN, VERIFY_EMAIL, WAIT_INCREMENT_SECONDS, ID) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) [23505-173] at org.h2.message.DbException.getJdbcSQLException(DbException.java:331) at org.h2.message.DbException.get(DbException.java:171) at org.h2.message.DbException.get(DbException.java:148) at org.h2.index.BaseIndex.getDuplicateKeyException(BaseIndex.java:101) at org.h2.index.PageBtree.find(PageBtree.java:121) at org.h2.index.PageBtreeLeaf.addRow(PageBtreeLeaf.java:148) at org.h2.index.PageBtreeLeaf.addRowTry(PageBtreeLeaf.java:101) at org.h2.index.PageBtreeIndex.addRow(PageBtreeIndex.java:95) at org.h2.index.PageBtreeIndex.add(PageBtreeIndex.java:86) at org.h2.table.RegularTable.addRow(RegularTable.java:125) at org.h2.command.dml.Insert.insertRows(Insert.java:127) at org.h2.command.dml.Insert.update(Insert.java:86) at org.h2.command.CommandContainer.update(CommandContainer.java:79) at org.h2.command.Command.executeUpdate(Command.java:235) at org.h2.jdbc.JdbcPreparedStatement.executeUpdateInternal(JdbcPreparedStatement.java:154) at org.h2.jdbc.JdbcPreparedStatement.executeUpdate(JdbcPreparedStatement.java:140) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeUpdate(WrappedPreparedStatement.java:493) at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(ResultSetReturnImpl.java:187) [hibernate-core-4.3.5.Final.jar:4.3.5.Final] ... 44 more

11 years, 11 months

2
1
0 / 0

Re: [keycloak-user] Exported realm cannot be imported

by Christina Lau

I did not use a command line to import, I use the UI “import realm”, similar to your example after a new install.

11 years, 11 months

2
1
0 / 0

HTTPS domain behaviour for Keycloak

by Adil Arif

Keycloak requires HTTPS when connecting to auth-server.war that is deployed to a JBoss EAP 6.3 domain with a server group that has more than 1 server. Is that an expected behaviour or a bug? I notice this behaviour isn't present in beta 3. Thanks!

11 years, 11 months

2
1
0 / 0

Exported realm cannot be imported

by Christina Lau

I exported a realm I created on beta-4 using this command: ./standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=dsgapi.json -Dkeycloak.migration.realmName=DSG_API I then try to import it into another new instance. However I got this error. Any idea? Is this possible? I can send the json file if it helps. 12:08:10,574 WARN [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-26) SQL Error: 23505, SQLState: 23505 12:08:10,574 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-26) Unique index or primary key violation: "UK_B71CJLBENV945RB6GCON438AT_INDEX_7 ON PUBLIC.CLIENT(REALM_ID, NAME) VALUES ( /* key:17 */ null, null, null, null, null, 'security-admin-console', null, null, null, null, null, null, null, null, 'cc0823c1-dab8-4f17-9b23-b04708d3b523')"; SQL statement: insert into CLIENT (ALLOWED_CLAIMS_MASK, ENABLED, FULL_SCOPE_ALLOWED, NAME, NOT_BEFORE, PUBLIC_CLIENT, REALM_ID, SECRET, BASE_URL, BEARER_ONLY, MANAGEMENT_URL, SURROGATE_AUTH_REQUIRED, DTYPE, ID) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'ApplicationEntity', ?) [23505-173] 12:08:10,576 INFO [org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl] (default task-26) HHH000010: On release of batch it still contained JDBC statements

11 years, 11 months

2
1
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2014